@better-forge/vault 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BetterStatusPage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @better-forge/vault
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Local vault crypto, HashiCorp client, secret resolution and vault routes.
+
+Status: skeleton. Depends on: `@better-forge/db`.

package/dist/createVault.d.ts

@@ -0,0 +1,70 @@
+import type { FastifyRequest } from 'fastify';
+import type { SqliteDatabase } from '@better-forge/db';
+import { type SecretBox } from './secretBox.js';
+import { type VaultAudit } from './vaultRoutes.js';
+export interface VaultOptions {
+    /** The application's database handle. It is used lazily, so it may be opened after this is created. */
+    db: SqliteDatabase;
+    audit: VaultAudit;
+    /** The signed-in caller of a request; the routes sit behind the application's own guards. */
+    identity: (req: FastifyRequest) => {
+        userId: number;
+        email: string;
+    };
+    /** Where the encryption key comes from. Defaults to the process environment. */
+    env?: NodeJS.ProcessEnv;
+    /** A box the application already created, for the tables that seal their own columns; it is made from `env` when absent. */
+    secretBox?: SecretBox;
+}
+/**
+ * Vaults of secrets (kept encrypted here, or read live from HashiCorp Vault), the lookup that turns a reference into
+ * its value, and the routes that manage them. Everything is built from `options` and kept in the returned closures.
+ */
+export declare function createVault(options: VaultOptions): {
+    secretBox: SecretBox;
+    hashicorp: {
+        sealConnection: (cfg: import("./hashicorp.js").HashicorpConfig) => string;
+        openConnection: (sealed: string | null) => import("./hashicorp.js").HashicorpConfig;
+        forgetHashicorpVault: (vaultId: number) => void;
+        forgetCredentialDependents: (vaultId: number, secretId?: number) => void;
+        readKvSecret: (vault: import("./hashicorp.js").HashicorpVaultRow, path: string) => Promise<Record<string, unknown>>;
+        verifyCredentialsRef: (cfg: import("./hashicorp.js").HashicorpConfig) => Promise<void>;
+        testConnection: (vault: import("./hashicorp.js").HashicorpVaultRow) => Promise<{
+            authMethod: import("./hashicorp.js").HashicorpAuthMethod;
+            ttlSeconds: number | null;
+        }>;
+        testDraftConnection: (cfg: import("./hashicorp.js").HashicorpConfig) => Promise<{
+            authMethod: import("./hashicorp.js").HashicorpAuthMethod;
+            ttlSeconds: number | null;
+        }>;
+    };
+    resolver: {
+        loadSecretPayload: (secret: {
+            id: number;
+            name: string;
+            type: string;
+            createdAt: number;
+            updatedAt: number;
+            vaultId: number;
+            encryptedValue: string;
+        }, vault: {
+            id: number;
+            name: string;
+            type: string;
+            description: string | null;
+            createdAt: number;
+            updatedAt: number;
+            connectionConfig: string | null;
+        }) => Promise<Record<string, unknown>>;
+        resolveVaultSecret: (ref: import("@better-forge/contracts").VaultRef) => Promise<Record<string, string>>;
+    };
+    /** Plain plugins, so the hooks of the scope they are registered in apply to them. */
+    routes: {
+        /** Read-only catalogue of vault and secret names and types, never values. */
+        catalogue: (app: import("fastify").FastifyInstance) => Promise<void>;
+        /** Create, change, reveal and delete vaults and secrets. */
+        manage: (app: import("fastify").FastifyInstance) => Promise<void>;
+    };
+};
+export type Vault = ReturnType<typeof createVault>;
+//# sourceMappingURL=createVault.d.ts.map

package/dist/createVault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createVault.d.ts","sourceRoot":"","sources":["../src/createVault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAErE,MAAM,WAAW,YAAY;IAC3B,uGAAuG;IACvG,EAAE,EAAE,cAAc,CAAA;IAClB,KAAK,EAAE,UAAU,CAAA;IACjB,6FAA6F;IAC7F,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,4HAA4H;IAC5H,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAW7C,qFAAqF;;QAEnF,6EAA6E;;QAE7E,4DAA4D;;;EAIjE;AAED,MAAM,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAA"}

package/dist/createVault.js

@@ -0,0 +1,28 @@
+import { createHashicorp } from './hashicorp.js';
+import { createSecretBox } from './secretBox.js';
+import { createSecretResolver } from './resolveSecret.js';
+import { createVaultRoutes } from './vaultRoutes.js';
+/**
+ * Vaults of secrets (kept encrypted here, or read live from HashiCorp Vault), the lookup that turns a reference into
+ * its value, and the routes that manage them. Everything is built from `options` and kept in the returned closures.
+ */
+export function createVault(options) {
+    const secretBox = options.secretBox ?? createSecretBox(options.env ? { env: options.env } : {});
+    const ctx = { db: options.db, secretBox };
+    const hashicorp = createHashicorp(ctx);
+    const resolver = createSecretResolver(ctx, hashicorp);
+    const routes = createVaultRoutes({ ...ctx, audit: options.audit, identity: options.identity }, { hashicorp, resolver });
+    return {
+        secretBox,
+        hashicorp,
+        resolver,
+        /** Plain plugins, so the hooks of the scope they are registered in apply to them. */
+        routes: {
+            /** Read-only catalogue of vault and secret names and types, never values. */
+            catalogue: routes.vaultCatalogRoutes,
+            /** Create, change, reveal and delete vaults and secrets. */
+            manage: routes.vaultRoutes,
+        },
+    };
+}
+//# sourceMappingURL=createVault.js.map

package/dist/createVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createVault.js","sourceRoot":"","sources":["../src/createVault.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAkB,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAmB,MAAM,kBAAkB,CAAA;AAcrE;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC/F,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,CAAA;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAEvH,OAAO;QACL,SAAS;QACT,SAAS;QACT,QAAQ;QACR,qFAAqF;QACrF,MAAM,EAAE;YACN,6EAA6E;YAC7E,SAAS,EAAE,MAAM,CAAC,kBAAkB;YACpC,4DAA4D;YAC5D,MAAM,EAAE,MAAM,CAAC,WAAW;SAC3B;KACF,CAAA;AACH,CAAC"}

package/dist/hashicorp.d.ts

@@ -0,0 +1,92 @@
+import type { SqliteDatabase } from '@better-forge/db';
+import type { SecretBox } from './secretBox.js';
+/**
+ * Client for HashiCorp Vault (KV v2). A vault of type `hashicorp` keeps only the
+ * connection settings (encrypted); secret values are read live on every use and never stored.
+ *
+ * The Vault address is private-network by nature, so unlike webhooks no public-IP guard applies.
+ * Instead the token is protected by: no redirects, strict path-segment validation, a response size
+ * cap and fixed error messages that never echo request headers, bodies or credentials.
+ */
+export type HashicorpAuthMethod = 'token' | 'approle';
+export interface HashicorpConfig {
+    address: string;
+    namespace?: string;
+    mount: string;
+    authMethod: HashicorpAuthMethod;
+    token?: string | undefined;
+    roleId?: string;
+    secretId?: string;
+    approleMount: string;
+    caCert?: string;
+    /**
+     * Reads the credentials from a secret in a local vault instead of storing them here: a Secure Value or JSON
+     * secret holding the token, or a User / Password (Role ID and Secret ID) or JSON secret for AppRole.
+     */
+    credentialsRef?: CredentialsRef;
+}
+export interface CredentialsRef {
+    vaultId: number;
+    secretId: number;
+    /** For a JSON secret: the JSON key holding each credential (`token`, or `roleId` and `secretId`); the key defaults to that name. */
+    fieldMapping?: Record<string, string>;
+}
+/** Message is always safe to return to the browser. */
+export declare class HashicorpVaultError extends Error {
+}
+/** Mutable so tests can shorten the timeout. */
+export declare const hashicorpLimits: {
+    timeoutMs: number;
+    maxBodyBytes: number;
+    /** A 403 for a token younger than this is a policy denial, not an expired token: no new login. */
+    freshTokenMs: number;
+    /** Grace period before a replaced connection pool is closed, so in-flight requests can finish. */
+    agentCloseDelayMs: number;
+};
+/** Validates a slash-separated Vault path and returns it URL-encoded per segment. */
+export declare function encodePath(raw: string, label: string): string;
+/**
+ * Validates connection input from the admin API. With `existing`, blank credentials keep the stored
+ * ones, except when the address, namespace, auth method or AppRole mount changes: credentials must
+ * then be sent again, so a changed address cannot receive a stored token.
+ */
+export declare function parseConnection(input: unknown, existing?: HashicorpConfig): HashicorpConfig;
+/** Connection settings safe to return to admins: credentials are reported only as present or not. */
+export declare function publicConnection(cfg: HashicorpConfig): {
+    address: string;
+    namespace: string;
+    mount: string;
+    authMethod: HashicorpAuthMethod;
+    approleMount: string;
+    roleId: string;
+    caCert: string;
+    hasToken: boolean;
+    hasSecretId: boolean;
+    credentialsRef: CredentialsRef | null;
+};
+export interface HashicorpVaultRow {
+    id: number;
+    updatedAt: number;
+    connectionConfig: string | null;
+}
+export declare function createHashicorp(ctx: {
+    db: SqliteDatabase;
+    secretBox: SecretBox;
+}): {
+    sealConnection: (cfg: HashicorpConfig) => string;
+    openConnection: (sealed: string | null) => HashicorpConfig;
+    forgetHashicorpVault: (vaultId: number) => void;
+    forgetCredentialDependents: (vaultId: number, secretId?: number) => void;
+    readKvSecret: (vault: HashicorpVaultRow, path: string) => Promise<Record<string, unknown>>;
+    verifyCredentialsRef: (cfg: HashicorpConfig) => Promise<void>;
+    testConnection: (vault: HashicorpVaultRow) => Promise<{
+        authMethod: HashicorpAuthMethod;
+        ttlSeconds: number | null;
+    }>;
+    testDraftConnection: (cfg: HashicorpConfig) => Promise<{
+        authMethod: HashicorpAuthMethod;
+        ttlSeconds: number | null;
+    }>;
+};
+export type Hashicorp = ReturnType<typeof createHashicorp>;
+//# sourceMappingURL=hashicorp.d.ts.map

package/dist/hashicorp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashicorp.d.ts","sourceRoot":"","sources":["../src/hashicorp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C;;;;;;;GAOG;AAEH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAA;AAErD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,mBAAmB,CAAA;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,oIAAoI;IACpI,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACtC;AAKD,uDAAuD;AACvD,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAEjD,gDAAgD;AAChD,eAAO,MAAM,eAAe;;;IAG1B,kGAAkG;;IAElG,kGAAkG;;CAEnG,CAAA;AAgBD,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAa7D;AAuBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,eAAe,CAsD3F;AAiBD,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe;;;;;;;;;;;EAapD;AAID,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAcD,wBAAgB,eAAe,CAAC,GAAG,EAAE;IAAE,EAAE,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE;0BAIlD,eAAe,KAAG,MAAM;6BAIrB,MAAM,GAAG,IAAI,KAAG,eAAe;oCAYxB,MAAM,KAAG,IAAI;0CAWP,MAAM,aAAa,MAAM,KAAG,IAAI;0BAmK1C,iBAAiB,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gCAc5D,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC;4BAKnC,iBAAiB,KAAG,OAAO,CAAC;QAAE,UAAU,EAAE,mBAAmB,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;+BAKxF,eAAe,KAAG,OAAO,CAAC;QAAE,UAAU,EAAE,mBAAmB,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;EAyBlI;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA"}

package/dist/hashicorp.js

@@ -0,0 +1,436 @@
+import { Agent, fetch as httpFetch } from 'undici';
+import { and, eq } from 'drizzle-orm';
+import { vaults, vaultSecrets } from './tables.js';
+/** Message is always safe to return to the browser. */
+export class HashicorpVaultError extends Error {
+}
+/** Mutable so tests can shorten the timeout. */
+export const hashicorpLimits = {
+    timeoutMs: 10_000,
+    maxBodyBytes: 1024 * 1024,
+    /** A 403 for a token younger than this is a policy denial, not an expired token: no new login. */
+    freshTokenMs: 10_000,
+    /** Grace period before a replaced connection pool is closed, so in-flight requests can finish. */
+    agentCloseDelayMs: 30_000,
+};
+const MAX_FIELD = 2048;
+const MAX_CA = 64 * 1024;
+function text(value, label, max = MAX_FIELD) {
+    if (value === undefined || value === null || value === '')
+        return undefined;
+    if (typeof value !== 'string')
+        throw new HashicorpVaultError(`${label} must be a string`);
+    const trimmed = value.trim();
+    if (trimmed.length > max)
+        throw new HashicorpVaultError(`${label} is too long`);
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f]/.test(trimmed))
+        throw new HashicorpVaultError(`${label} contains invalid characters`);
+    return trimmed || undefined;
+}
+/** Validates a slash-separated Vault path and returns it URL-encoded per segment. */
+export function encodePath(raw, label) {
+    const segments = raw.trim().replace(/^\/+|\/+$/g, '').split('/');
+    if (segments.length === 0 || segments.some((s) => s === '')) {
+        throw new HashicorpVaultError(`${label} is invalid`);
+    }
+    return segments.map((segment) => {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            throw new HashicorpVaultError(`${label} is invalid`);
+        }
+        if (decoded === '.' || decoded === '..' || decoded.includes('/') || decoded.includes('\\')) {
+            throw new HashicorpVaultError(`${label} is invalid`);
+        }
+        return encodeURIComponent(decoded);
+    }).join('/');
+}
+function requiredText(value, label) {
+    const v = text(value, label);
+    if (!v)
+        throw new HashicorpVaultError(`${label} is required`);
+    return v;
+}
+function normalizeAddress(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new HashicorpVaultError('Address must be a valid URL');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new HashicorpVaultError('Address must start with http:// or https://');
+    }
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/') {
+        throw new HashicorpVaultError('Address must be a plain URL such as https://vault.example.com:8200');
+    }
+    return url.origin;
+}
+/** True when changing these fields would redirect stored credentials somewhere else. */
+const IDENTITY_FIELDS = ['address', 'namespace', 'mount', 'authMethod', 'approleMount', 'caCert'];
+/**
+ * Validates connection input from the admin API. With `existing`, blank credentials keep the stored
+ * ones, except when the address, namespace, auth method or AppRole mount changes: credentials must
+ * then be sent again, so a changed address cannot receive a stored token.
+ */
+export function parseConnection(input, existing) {
+    if (!input || typeof input !== 'object')
+        throw new HashicorpVaultError('Connection settings are required');
+    const body = input;
+    const authMethod = body['authMethod'] ?? existing?.authMethod;
+    if (authMethod !== 'token' && authMethod !== 'approle') {
+        throw new HashicorpVaultError('Auth method must be token or approle');
+    }
+    const namespace = text(body['namespace'], 'Namespace');
+    const cfg = {
+        address: normalizeAddress(requiredText(body['address'], 'Address')),
+        mount: requiredText(body['mount'] ?? 'secret', 'KV mount'),
+        authMethod,
+        approleMount: text(body['approleMount'], 'AppRole mount') ?? 'approle',
+    };
+    if (namespace)
+        cfg.namespace = namespace;
+    encodePath(cfg.mount, 'KV mount');
+    encodePath(cfg.approleMount, 'AppRole mount');
+    if (cfg.namespace)
+        encodePath(cfg.namespace, 'Namespace');
+    const caCert = text(body['caCert'], 'CA certificate', MAX_CA);
+    if (caCert) {
+        if (!caCert.includes('BEGIN CERTIFICATE'))
+            throw new HashicorpVaultError('CA certificate must be PEM encoded');
+        cfg.caCert = caCert;
+    }
+    const identityChanged = existing ? IDENTITY_FIELDS.some((f) => (existing[f] ?? '') !== (cfg[f] ?? '')) : false;
+    const keep = existing && !identityChanged ? existing : undefined;
+    // An object picks a local vault secret; null means direct input; absent keeps what is saved.
+    const refInput = body['credentialsRef'];
+    if (refInput !== undefined && refInput !== null) {
+        cfg.credentialsRef = parseCredentialsRef(refInput, authMethod);
+        return cfg;
+    }
+    const keptRef = refInput === undefined ? keep?.credentialsRef : undefined;
+    if (authMethod === 'token') {
+        const typed = text(body['token'], 'Token');
+        if (!typed && keptRef) {
+            cfg.credentialsRef = keptRef;
+            return cfg;
+        }
+        const token = typed ?? keep?.token;
+        if (!token)
+            throw new HashicorpVaultError(identityChanged ? 'Re-enter the token after changing the connection target' : 'Token is required');
+        cfg.token = token;
+    }
+    else {
+        const typedSecretId = text(body['secretId'], 'Secret ID');
+        const typedRoleId = text(body['roleId'], 'Role ID');
+        if (!typedSecretId && !typedRoleId && keptRef) {
+            cfg.credentialsRef = keptRef;
+            return cfg;
+        }
+        const roleId = typedRoleId ?? keep?.roleId;
+        const secretId = typedSecretId ?? keep?.secretId;
+        if (!roleId || !secretId) {
+            throw new HashicorpVaultError(identityChanged ? 'Re-enter the Role ID and Secret ID after changing the connection target' : 'Role ID and Secret ID are required');
+        }
+        cfg.roleId = roleId;
+        cfg.secretId = secretId;
+    }
+    return cfg;
+}
+function parseCredentialsRef(input, authMethod) {
+    const { vaultId, secretId, fieldMapping } = (typeof input === 'object' ? input : {});
+    if (!Number.isInteger(vaultId) || !Number.isInteger(secretId) || vaultId <= 0 || secretId <= 0) {
+        throw new HashicorpVaultError('Select a secret from a local vault for the credentials');
+    }
+    const ref = { vaultId: vaultId, secretId: secretId };
+    const mapping = {};
+    for (const field of authMethod === 'token' ? ['token'] : ['roleId', 'secretId']) {
+        const key = text(fieldMapping?.[field], 'JSON key', 200);
+        if (key)
+            mapping[field] = key;
+    }
+    if (Object.keys(mapping).length)
+        ref.fieldMapping = mapping;
+    return ref;
+}
+/** Connection settings safe to return to admins: credentials are reported only as present or not. */
+export function publicConnection(cfg) {
+    return {
+        address: cfg.address,
+        namespace: cfg.namespace ?? '',
+        mount: cfg.mount,
+        authMethod: cfg.authMethod,
+        approleMount: cfg.approleMount,
+        roleId: cfg.roleId ?? '',
+        caCert: cfg.caCert ?? '',
+        hasToken: !!cfg.token,
+        hasSecretId: !!cfg.secretId,
+        credentialsRef: cfg.credentialsRef ?? null,
+    };
+}
+export function createHashicorp(ctx) {
+    const { db } = ctx;
+    const { encrypt, decrypt } = ctx.secretBox;
+    function sealConnection(cfg) {
+        return encrypt(JSON.stringify(cfg));
+    }
+    function openConnection(sealed) {
+        if (!sealed)
+            throw new HashicorpVaultError('Vault connection is not configured');
+        try {
+            return JSON.parse(decrypt(sealed));
+        }
+        catch {
+            throw new HashicorpVaultError('Failed to decrypt vault connection');
+        }
+    }
+    const sessions = new Map();
+    /** Drops the cached token and closes the connection pool; call after the vault is changed or deleted. */
+    function forgetHashicorpVault(vaultId) {
+        const session = sessions.get(vaultId);
+        sessions.delete(vaultId);
+        const agent = session?.agent;
+        if (agent)
+            setTimeout(() => void agent.close().catch(() => undefined), hashicorpLimits.agentCloseDelayMs).unref();
+    }
+    /**
+     * Drops the cached sessions of HashiCorp vaults that read their credentials from this local vault (or one
+     * of its secrets), so a rotated or deleted secret is used from the next request, also for AppRole.
+     */
+    function forgetCredentialDependents(vaultId, secretId) {
+        for (const [id, session] of sessions) {
+            const ref = session.cfg.credentialsRef;
+            if (ref && ref.vaultId === vaultId && (secretId === undefined || ref.secretId === secretId))
+                forgetHashicorpVault(id);
+        }
+    }
+    function sessionFor(vault) {
+        const existing = sessions.get(vault.id);
+        if (existing && existing.fingerprint === vault.updatedAt)
+            return existing;
+        forgetHashicorpVault(vault.id);
+        const cfg = openConnection(vault.connectionConfig);
+        const session = {
+            fingerprint: vault.updatedAt,
+            cfg,
+            agent: cfg.caCert ? new Agent({ connect: { ca: cfg.caCert } }) : undefined,
+            expiresAt: 0,
+            loginAt: 0,
+        };
+        sessions.set(vault.id, session);
+        return session;
+    }
+    function scrub(message, creds) {
+        let out = message;
+        for (const secret of [creds?.token, creds?.secretId])
+            if (secret)
+                out = out.split(secret).join('[redacted]');
+        return out;
+    }
+    /**
+     * Returns the credentials to use now. A referenced local vault secret is read on every call, so a
+     * rotation there takes effect on the next request; it must still exist, live in a local vault and
+     * have the type the auth method needs.
+     */
+    async function credentialsFor(session) {
+        const { cfg } = session;
+        const ref = cfg.credentialsRef;
+        if (!ref)
+            return (session.creds = { token: cfg.token, roleId: cfg.roleId, secretId: cfg.secretId });
+        const [row] = await db.select().from(vaultSecrets).where(and(eq(vaultSecrets.id, ref.secretId), eq(vaultSecrets.vaultId, ref.vaultId)));
+        const [owner] = row ? await db.select({ type: vaults.type }).from(vaults).where(eq(vaults.id, ref.vaultId)) : [];
+        if (!row || owner?.type !== 'local')
+            throw new HashicorpVaultError('the credentials secret no longer exists in a local vault');
+        let payload;
+        try {
+            payload = JSON.parse(decrypt(row.encryptedValue));
+        }
+        catch {
+            throw new HashicorpVaultError('the credentials secret cannot be decrypted');
+        }
+        // Same trimming and character checks as typed credentials, so a stray newline is a clear error, not a failed request.
+        const clean = (value) => { try {
+            return text(value, 'The credentials secret');
+        }
+        catch {
+            return undefined;
+        } };
+        // A JSON secret holds an object; the mapping (or the default key names) picks each credential from it.
+        let fields = {};
+        if (row.type === 'json') {
+            try {
+                fields = JSON.parse(String(payload['value'] ?? ''));
+            }
+            catch { /* reported below as a missing credential */ }
+        }
+        const pick = (field) => clean(fields[ref.fieldMapping?.[field] ?? field]);
+        if (cfg.authMethod === 'token') {
+            const token = row.type === 'value' ? clean(payload['value']) : row.type === 'json' ? pick('token') : undefined;
+            if (!token)
+                throw new HashicorpVaultError('the credentials secret must be a Secure Value, or a JSON secret with the token key');
+            return (session.creds = { token });
+        }
+        const roleId = row.type === 'userpass' ? clean(payload['username']) : row.type === 'json' ? pick('roleId') : undefined;
+        const secretId = row.type === 'userpass' ? clean(payload['password']) : row.type === 'json' ? pick('secretId') : undefined;
+        if (!roleId || !secretId) {
+            throw new HashicorpVaultError('the credentials secret must be a User / Password secret, or a JSON secret with the Role ID and Secret ID keys');
+        }
+        return (session.creds = { roleId, secretId });
+    }
+    function describeNetworkError(err) {
+        const e = err;
+        if (e?.name === 'TimeoutError' || e?.name === 'AbortError') {
+            return `timed out after ${Math.round(hashicorpLimits.timeoutMs / 1000)} s`;
+        }
+        const code = e?.cause?.code ?? '';
+        if (/redirect/i.test(e?.cause?.message ?? e?.message ?? ''))
+            return 'redirects are not followed';
+        if (/^(UNABLE_TO|CERT_|DEPTH_ZERO|SELF_SIGNED|ERR_TLS|ERR_SSL|HOSTNAME_MISMATCH)/.test(code)) {
+            return `TLS certificate not trusted (${code})`;
+        }
+        return code ? `cannot connect (${code})` : 'cannot connect';
+    }
+    async function readCapped(res) {
+        const reader = res.body?.getReader();
+        if (!reader)
+            return null;
+        const chunks = [];
+        let size = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > hashicorpLimits.maxBodyBytes) {
+                void reader.cancel();
+                throw new HashicorpVaultError('response from Vault is too large');
+            }
+            chunks.push(value);
+        }
+        try {
+            return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        }
+        catch {
+            return null;
+        }
+    }
+    async function call(session, method, apiPath, token, body) {
+        const { cfg } = session;
+        const headers = { 'X-Vault-Request': 'true' };
+        if (token)
+            headers['X-Vault-Token'] = token;
+        if (cfg.namespace)
+            headers['X-Vault-Namespace'] = cfg.namespace;
+        if (body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        try {
+            const res = await httpFetch(`${cfg.address}/v1/${apiPath}`, {
+                method,
+                headers,
+                ...(body !== undefined && { body: JSON.stringify(body) }),
+                redirect: 'error',
+                signal: AbortSignal.timeout(hashicorpLimits.timeoutMs),
+                ...(session.agent && { dispatcher: session.agent }),
+            });
+            return { status: res.status, json: await readCapped(res) };
+        }
+        catch (err) {
+            if (err instanceof HashicorpVaultError)
+                throw err;
+            throw new HashicorpVaultError(scrub(describeNetworkError(err), session.creds));
+        }
+    }
+    function login(session) {
+        session.login ??= (async () => {
+            const { cfg } = session;
+            const creds = await credentialsFor(session);
+            const { status, json } = await call(session, 'POST', `auth/${encodePath(cfg.approleMount, 'AppRole mount')}/login`, undefined, { role_id: creds.roleId, secret_id: creds.secretId });
+            const auth = json?.auth;
+            if (status !== 200 || !auth?.client_token) {
+                throw new HashicorpVaultError(status === 400 || status === 403 ? 'AppRole login was rejected' : `AppRole login failed (HTTP ${status})`);
+            }
+            const ttlMs = (auth.lease_duration ?? 0) * 1000;
+            session.token = auth.client_token;
+            session.loginAt = Date.now();
+            // A lease of 0 means the token does not expire; a 403 then decides when to log in again.
+            session.expiresAt = ttlMs > 0 ? session.loginAt + ttlMs - Math.min(60_000, ttlMs * 0.1) : Infinity;
+            return auth.client_token;
+        })().finally(() => { session.login = undefined; });
+        return session.login;
+    }
+    async function tokenFor(session) {
+        if (session.cfg.authMethod === 'token')
+            return (await credentialsFor(session)).token;
+        if (session.token && Date.now() < session.expiresAt)
+            return session.token;
+        return login(session);
+    }
+    /** Authenticated request; with AppRole a 403 triggers one fresh login and retry. */
+    async function authed(session, method, apiPath) {
+        const used = await tokenFor(session);
+        let res = await call(session, method, apiPath, used);
+        const expired = session.cfg.authMethod === 'approle' && session.token === used
+            && Date.now() - session.loginAt >= hashicorpLimits.freshTokenMs;
+        if (res.status === 403 && expired) {
+            session.token = undefined;
+            res = await call(session, method, apiPath, await tokenFor(session));
+        }
+        return res;
+    }
+    /** Reads the data of a KV v2 secret (latest version). */
+    async function readKvSecret(vault, path) {
+        const session = sessionFor(vault);
+        const kvPath = encodePath(path, 'Path');
+        const { status, json } = await authed(session, 'GET', `${encodePath(session.cfg.mount, 'KV mount')}/data/${kvPath}`);
+        if (status === 404)
+            throw new HashicorpVaultError(`secret not found at ${session.cfg.mount}/${path.replace(/^\/+|\/+$/g, '')}`);
+        if (status === 403)
+            throw new HashicorpVaultError('permission denied (HTTP 403)');
+        const data = json?.data?.data;
+        if (status !== 200 || !data || typeof data !== 'object' || Array.isArray(data)) {
+            throw new HashicorpVaultError(`unexpected response from Vault (HTTP ${status})`);
+        }
+        return data;
+    }
+    /** Fails unless the connection's credentials secret (if any) exists in a local vault with the type its auth method needs. */
+    async function verifyCredentialsRef(cfg) {
+        if (cfg.credentialsRef)
+            await credentialsFor({ fingerprint: 0, cfg, expiresAt: 0, loginAt: 0 });
+    }
+    /** Verifies the saved credentials. Returns the remaining token TTL when Vault reports one. */
+    async function testConnection(vault) {
+        return verifySession(sessionFor(vault));
+    }
+    /** Verifies connection settings that are not saved yet, without touching the session cache. */
+    async function testDraftConnection(cfg) {
+        const agent = cfg.caCert ? new Agent({ connect: { ca: cfg.caCert } }) : undefined;
+        try {
+            return await verifySession({ fingerprint: 0, cfg, agent, expiresAt: 0, loginAt: 0 });
+        }
+        finally {
+            void agent?.close();
+        }
+    }
+    async function verifySession(session) {
+        session.token = undefined;
+        session.loginAt = 0;
+        const { cfg } = session;
+        if (cfg.authMethod === 'approle') {
+            await login(session);
+            return { authMethod: 'approle', ttlSeconds: Math.max(0, Math.round((session.expiresAt - Date.now()) / 1000)) };
+        }
+        const { status, json } = await call(session, 'GET', 'auth/token/lookup-self', (await credentialsFor(session)).token);
+        if (status === 403)
+            throw new HashicorpVaultError('token was rejected (HTTP 403)');
+        if (status !== 200)
+            throw new HashicorpVaultError(`unexpected response from Vault (HTTP ${status})`);
+        const ttl = json?.data?.ttl;
+        return { authMethod: 'token', ttlSeconds: typeof ttl === 'number' && ttl > 0 ? ttl : null };
+    }
+    return { sealConnection, openConnection, forgetHashicorpVault, forgetCredentialDependents, readKvSecret, verifyCredentialsRef, testConnection, testDraftConnection };
+}
+//# sourceMappingURL=hashicorp.js.map